3590 matches found
CVE-2026-62201-OpenClaw-SSRF
CVE-2026-62201 — Omisión de la política de red del Exec-Server del sandbox de OpenClaw SSRF Gravedad: Alta · CVSS: 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N · CWE-918 Server-Side Request Forgery Resumen de la vulnerabilidad Campo| Valor ---|--- Aviso| GHSA-mgvr-6gvw-3rgr NVD| CVE-2026-6220...
PoC-CVE-2026-33017
CVE-2026-33017: RCE no autenticado en Langflow...
CVE-2026-33017-Exploit
CVE-2026-33017 - Langflow RCE sin autenticación / \ | | \ ^ / ||||| exec sin autenticación, sin sandbox, sin esperanza. Langflow chat.py - startflowbuild - buildgraphfromdata - Graph.frompayload - loading.py - eval.py createclass - validate.py prepareglobalscope - execcompiledcode - el código...
CVE-2026-33017-Langflow-RCE-PoC
CVE-2026-33017-Langflow-RCE-PoC La vulnerabilidad en Langflow 1.8.1 y versiones anteriores permite a un atacante remoto no autenticado lograr la ejecución arbitraria de comandos en el host. Descripción El endpoint POST /api/v1/buildpublictmp/flowid/flow permite a cualquier persona construir flujo...
lsm_bpf_check_argc0
Check ARGC0 LSM BPF Simple LSM BPF program to prevent program executions with argc == 0, e.g. pwnkit CVE-2021-4034. It does nothing more than a simple check that all exec system calls are called with argc = 1. The check is based on Ariadne Conill's patch. How to build On Ubuntu $ sudo apt-get...
CVE-2026-0770-PoC
CVE-2026-0770 - Ejecución Remota de Código en Langflow Resumen Langflow contiene una vulnerabilidad crítica de ejecución remota de código en la función validatecode ubicada en src/lfx/src/lfx/custom/validate.py. La función utiliza exec para ejecutar código Python proporcionado por el usuario sin...
CVE-2026-33017
CVE-2026-33017 — Langflow RCE sin autenticación HoGent CyberSecurity II — Netwerk Pentesting & Exploitatie NPE Academiejaar 2025–2026 Resumen Este repositorio contiene un entorno de laboratorio completo y una demostración de explotación de CVE-2026-33017 , una vulnerabilidad crítica de ejecución...
CVE-2025-3248
CVE-2025-3248 Langflow es una plataforma low-code utilizada principalmente para construir y desplegar agentes de IA y flujos de trabajo. Simplifica el proceso de desarrollo al proporcionar una interfaz visual para crear aplicaciones complejas de IA, incluidos chatbots, sistemas RAG Generación...
CVE-2026-97359
HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template...
cve-2026-33067
CVE-2026-33017 — Plantilla Nuclei para RCE sin autenticación en Langflow Plantilla Nuclei que detecta CVE-2026-33017 — una vulnerabilidad de ejecución remota de código sin autenticación en Langflow ≤ 1.8.2 accesible a través del endpoint público de construcción de flujos: POST...
CVE-2025-3248-POC
Langflow RCE 漏洞利用 - CVE-2025-3248 ⚠️ 免责声明 此代码仅严格用于教育和研究目的 。未经明确许可在系统上使用可能构成违法行为。 作者对此工具的任何误用或恶意行为概不负责 。 漏洞信息 CVE-2025-3248 - 严重 CVSS 评分：9.8 | EPSS 评分：92.57% | 发布时间：2025 年 5 月 22 日 受影响版本 存在漏洞： 所有版本 ≤ v1.3.0 已修补： v1.3.0 及以上版本 攻击向量 端点 /api/v1/validate/code 接受未经过滤的 Python 代码，并直接使用 exec 执行，无需身份验证。 漏洞代码...
CVE-2026-97359: Improper Neutralization of Special Elements Used in a Template Engine
HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template...
CVE-2026-77285
OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from envtemplate to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after...
CVE-2026-77285
A flaw was found in OpenBao Agent. The agent's exec rendering mode can incorrectly write secrets from envtemplate to standard output. This occurs when the template runner is re-created after repeated rendering failures, specifically when numretries is met. A local user, process supervisor, or log...
CVE-2026-77285
The OpenBao Agent 's exec rendering mode contains a flaw where it can incorrectly write secrets from env_template to standard output . This vulnerability occurs when command/agent/exec/exec.go re-creates the template runner following repeated rendering failures, specifically when the num_retries ...
CVE-2026-77285 OpenBao Agent Writes Secrets to Stdout
OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from envtemplate to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after...
OpenBao Agent Writes Secrets to Stdout
Impact During certain error conditions, OpenBao Agent's exec rendering mode will incorrectly write secrets specified in envtemplate to stdout. This primarily happens when numretries is met. This vulnerability is original to Vault and was reported via the OpenBao security mailing list. Patches Thi...
Insertion of Sensitive Information into Log File
Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the exec rendering mode during certain error conditions, specifically when numretries is met. An attacker can obtain sensitive information by accessing stdout output that may contain...
CVE-2026-87909: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...
